The threat landscape.
Ten things that happen to college programs, described as they actually occur rather than as they appear on television. Half concern the program's information. Half concern its athletes. Most departments are exposed to several and have a plan for none.
Two kinds of exposure.
The first five concern what a program knows: its game plan, its signals, its personnel decisions, its injuries. The second five concern who a program employs and enrolls: coaches and athletes who are now worth targeting by people who have never met them.
The two are handled by different people inside the firm's practice but examined together in the assessment, because the same habits produce both: a telephone that is not locked, a door that is not latched, a stranger who is treated as a friend because he knows the right names.
Five that concern what the program knows.
Signal and game‑plan theft.
A rival learns what a program intends to do before it does it. Historically by in-person scouting and film; now by a telephone in the stands, a drone over a practice field, or a staff member's tablet left unlocked in a hotel lobby.
- How it arrives
- Someone with a camera where they should not be. A shared drive with former staff still on it. A signal system that has not changed in three seasons. A booster who repeats what he heard in the building.
- What it looks like
- Opponents who are a step early on the same calls. A reporter who knows a personnel decision before the team meeting. Usually nothing at all until the season is over.
- What has happened
- The first sign-stealing case the NCAA brought to a decision ended, in August 2025, in a ten-year show-cause order for a head coach and fines reported above thirty million dollars. The institution is appealing. Every program in the country now has the subject on its staff-meeting agenda.
- What the firm does
- A written signal-protection plan and a device plan for the staff, in a half-day or full-day tradecraft session. The game-day signal plan is observed in the assessment when the calendar allows.
The leak from inside.
Most leaks are not betrayal. They are pride. The booster at dinner, the spouse at church, the graduate assistant who wants a job at the school down the road. Someone showing off what they know to someone who was listening for it.
- How it arrives
- Three habits produce most of it: talking about work to people outside the building, leaving things where they can be read, and keeping former colleagues on group messages and shared drives after they have left.
- What it looks like
- Information appearing outside the building that was never public. Rarely a single dramatic event. Usually a slow pattern that a staff has learned to live with.
- What it is not
- A reason to investigate the staff. The firm's leak and insider review examines access and process through interviews, and never conducts surveillance of a client's own people.
- What the firm does
- Teaches the three habits and their remedies in the tradecraft session. Maps how information actually moves in the assessment, and writes findings that can be remedied without naming anyone.
The people who work a building.
Boosters, donors, former players, vendors, media, the recruit's uncle. People who are in the facility because someone let them in, who are friendly, and some of whom are also useful to a rival.
- How it arrives
- A question at a booster dinner that is really collection. A rival staffer on an official visit who notices what is on the whiteboard. A vendor on the building master key who services a closet behind the staff room on an unscheduled basis.
- What it looks like
- Nothing. Access is a habit, not a badge system, and the habit in most buildings is to be courteous to anyone who knows the right names.
- What the firm does
- An access review with facilities and campus police in the assessment: who holds keys and credentials, who services which rooms, and when. A set of building habits drafted by the staff themselves in the tradecraft session and owned by the director of operations for the season.
Telephones, tablets and the plan.
The entire game plan travels in the pockets of thirty people. A lost telephone, a tablet left on a bus, a playbook application that is also installed on a personal device, or a cloud backup copying the plan to an account no one administers.
- How it arrives
- Message previews visible on a locked screen. Short passcodes. Group chats with former staff still in them. Hotel networks. No one sure whom to call when a device goes missing on a Friday night.
- What it looks like
- A coach's telephone with the plan on it is missing on a road trip. The firm's assessment runs this exact scenario with the staff and records who receives the call and whether they know what to do.
- What the firm does
- A one-page device checklist every staff member completes in the tradecraft session and keeps. A device and document plan for each trip in the travel advance. Remote wipe enabled and tested once, before it is needed.
The road.
The hotel is the one building on the schedule the program does not control. Meeting rooms are booked by someone else, the coaches' floor is shared with strangers, the keys are cut by the front desk, and a rival may be in the same building for the same game.
- How it arrives
- A printed itinerary in the hotel bar. A rooming list sent to a distribution list. An installation meeting held in a room with a connecting door. Keys issued to people who are not on the travel party.
- What it looks like
- Bowl week, when the stakes are highest, the hotel is largest, the staff is tired, and the building is full of people with credentials of one kind or another.
- What the firm does
- The travel security advance: hotel and meeting-space selection with regard to who else is in the building, a room-assignment protocol for the coaches' floor, key control, a point of contact for the hotel's security staff, and inspection of the meeting room before the first meeting. The checklist is left with operations to run on subsequent trips.
Technical surveillance.
A device planted in a room where decisions are made. What is actually found in athletic programs is consumer-grade: trackers, small cameras, inexpensive transmitters, placed by people who had ordinary access to the room.
- How it arrives
- Through the people in the previous entries, not through a professional. A closet on a master key. A shared drop ceiling. A speakerphone that is always live. A vendor who was never escorted.
- What it looks like
- Most often, nothing is found, and the report says so plainly. The value of the inspection is in the observations: the door that does not latch, the room that should not be used for the Friday install.
- What the firm does
- Technical surveillance countermeasures on a schedule or before an event, with a report that leads with the instruments used and what each cannot detect. A sealed-room certification with laboratory-grade equipment is performed with a named partner, disclosed in advance. The assessment states which rooms warrant inspection and which do not; most programs require fewer than they fear.
Five that concern the people it employs and enrolls.
Sextortion.
An account that appears to be a student at another school, or a fan, begins a conversation. Within days, a request for images or a recorded video call. Within minutes of that, the threat: pay, or this goes to the coach, the family and every follower.
- How it arrives
- By direct message, at volume, from groups that are not interested in the individual and are interested in the next twenty minutes, because that is when most victims pay.
- What has happened
- The FBI, Homeland Security Investigations and the National Center for Missing and Exploited Children issued a national public safety alert after more than seven thousand reports of financial sextortion of minors in a single year, involving at least three thousand victims, most of them boys. The FBI named student athletes among those targeted.
- What the firm does
- The athlete safety briefing, built on real cases, and the first-hour card every player keeps: do not pay, screenshot everything, tell one adult who will not panic, report in the application and to the FBI, lock the accounts. The card is published here for any program to use.
Bettor harassment.
After a missed free throw, a fumble, or a game that failed to cover, a player's direct messages fill with strangers who lost money. Some of it is abuse. Some of it is threats. Some of it arrives at the player's dormitory and family.
- What has happened
- The NCAA's study with Signify Group found that twelve percent of the publicly posted social-media abuse directed at college athletes originated with sports bettors, and that sexual abuse was the largest category at eighteen percent. Direct messages, where the firm's experience says the worst of it arrives, were not counted.
- What it looks like
- Players who stop reading their messages, or who do not say anything at all. Blocking does not end it, because the same person opens another account.
- What the firm does
- Briefs the roster on what to preserve and whom to tell. Under the threat assessment and response retainer, triages whether a message is credible, whether it is new, and whether it is the same individual as before, and documents it in a form that holds with campus police, local police and the platform.
Impersonation and NIL fraud.
Name, image and likeness made a nineteen-year-old worth approaching. The fraudulent agent, the brand that does not exist, the account that is a copy of the player's own, and the synthetic video of a player saying something he never said.
- How it arrives
- A message from someone who claims to represent a brand or an agency, with a contract attached and a deadline. A copied account soliciting the player's followers. A fabricated clip circulated before a game.
- What it looks like
- Compliance learns of it after the player has signed something, or after the family has sent money to release a payment that was never coming.
- What the firm does
- Teaches the roster how to verify an approach in the briefing. Under the optional exposure service, conducts impersonation takedowns and reports to the department by category and severity only. Keeps compliance informed without handing it anything it would rather not hold.
Doxxing and exposure.
What a stranger can learn about a player in twenty minutes from a telephone with no special access: the address, the vehicle, the family, the class schedule, and the people around him who post everything.
- How it arrives
- Data brokers, tagged photographs, public records, a parent's public profile, a roommate's video with the building number visible. None of it is secret. All of it is assembled by anyone who is motivated.
- What it looks like
- A threat that names the dormitory. A stranger at the apartment. A bettor who knows the mother's name.
- What the firm does
- An open-source exposure check on a sample of the roster during the assessment, with players shown what is already public about them. Quarterly checks on the whole roster, with removal of exposed personal information, as an add-on to the briefing or inside the season retainer. The department sees categories and severity, never the contents.
What the firm does not treat.
Some matters belong to other people, and the firm says so.
- Event security and crowd management belong to campus police, the venue and the event security contractor.
- Executive protection for a coach or an athlete under a specific physical threat is referred to a licensed protection firm, with an introduction.
- Network security belongs to the institution's information technology office. The firm owns the space between the network and the people.
- Background investigations on recruits or hires are conducted under a state investigator's license, by a licensed firm.
- Gambling integrity monitoring is the province of the conference, the NCAA and their integrity partners.
Which of these apply to a particular program is the first question of the consultation.
Twenty minutes with the principal. A written proposal follows within three business days.